Platform Team Improves Compliance Adoption by Simplifying Governance and Prioritizing Developer Experience

Initial Challenges with Compliance Implementation

A newly formed platform team, composed of experienced developers, initially faced significant friction when implementing compliance roadmaps. Developers encountered new workflows, multiple AWS accounts, and unfamiliar concepts, leading to a decline in developer experience. Documentation was often lengthy, outdated, and difficult to navigate, resulting in frequent support requests and frustration.

Shift to an Empathetic Approach

The team shifted its strategy from forced workflows to an empathetic approach, focusing on simplifying governance and prioritizing what truly mattered. Davide de Paolis explained that success came from aligning around a shared purpose rather than dictating changes, recognizing that forced adoption rarely works effectively.

Incremental Rollout Strategy

Compliance initiatives were rolled out incrementally, using a three-pronged strategy: prevention, detection, and communication. This method involved informing developers first, then softly enforcing changes, and only later moving to stricter enforcement. This approach proved reusable across various internal compliance efforts.

Successful Resource Tagging Example

A concrete example of this strategy's success was the re-implementation of resource tagging. An earlier initiative had failed due to inconsistency and manual processes. The team simplified tagging by reducing required tags and standardizing them with AWS Tag Policies and Service Control Policies to prevent untagged resources. Concurrently, they used the AWS Security Hub Resource Tagging Standard to detect existing non-compliant resources, combining prevention, detection, and notification for better engagement.